| developer | 1f55fcf | 2024-10-17 14:52:33 +0800 | [diff] [blame^] | 1 | From e509c27732a53efc496081261df1c80b22a02b45 Mon Sep 17 00:00:00 2001 |
| developer | 05f3b2b | 2024-08-19 19:17:34 +0800 | [diff] [blame] | 2 | From: Bo Jiao <Bo.Jiao@mediatek.com> |
| 3 | Date: Thu, 27 Jun 2024 14:54:38 +0800 |
| developer | 1f55fcf | 2024-10-17 14:52:33 +0800 | [diff] [blame^] | 4 | Subject: [PATCH 156/193] mtk: mt76: mt7996: Fix NULL pointer crash when mac tx |
| developer | 05f3b2b | 2024-08-19 19:17:34 +0800 | [diff] [blame] | 5 | free with a msta that has been removed. |
| 6 | |
| 7 | Signed-off-by: Bo Jiao <Bo.Jiao@mediatek.com> |
| 8 | --- |
| 9 | mt7996/mac.c | 2 +- |
| 10 | 1 file changed, 1 insertion(+), 1 deletion(-) |
| 11 | |
| 12 | diff --git a/mt7996/mac.c b/mt7996/mac.c |
| developer | 1f55fcf | 2024-10-17 14:52:33 +0800 | [diff] [blame^] | 13 | index ee505a5..3cd034c 100644 |
| developer | 05f3b2b | 2024-08-19 19:17:34 +0800 | [diff] [blame] | 14 | --- a/mt7996/mac.c |
| 15 | +++ b/mt7996/mac.c |
| developer | d0c8945 | 2024-10-11 16:53:27 +0800 | [diff] [blame] | 16 | @@ -1212,7 +1212,7 @@ mt7996_mac_tx_free(struct mt7996_dev *dev, void *data, int len) |
| developer | 05f3b2b | 2024-08-19 19:17:34 +0800 | [diff] [blame] | 17 | struct mt7996_link_sta *mlink = |
| 18 | rcu_dereference(msta->link[link_id]); |
| 19 | |
| 20 | - if (list_empty(&mlink->wcid.poll_list)) |
| 21 | + if (mlink && list_empty(&mlink->wcid.poll_list)) |
| 22 | list_add_tail(&mlink->wcid.poll_list, &mdev->sta_poll_list); |
| 23 | } |
| 24 | spin_unlock_bh(&mdev->sta_poll_lock); |
| 25 | -- |
| developer | d0c8945 | 2024-10-11 16:53:27 +0800 | [diff] [blame] | 26 | 2.45.2 |
| developer | 05f3b2b | 2024-08-19 19:17:34 +0800 | [diff] [blame] | 27 | |